{"version":"2.1.234","anchor":"inline-policy-helpers-run-with-a-scrubbed-environment-and-a-","canonical_anchor":"inline-policy-helpers-run-with-a-scrubbed-environment-and-a-","heading":"Inline policy helpers run with a scrubbed environment and a fixed PowerShell path","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/inline-policy-helpers-run-with-a-scrubbed-environment-and-a-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Inline policy helpers run with a scrubbed environment and a fixed PowerShell path\n\nInline admin policy scripts run with a stripped environment and a PowerShell resolved from fixed paths only.\n\n**What**\n\nWhen an admin policy helper is delivered as an inline script, the child process environment is stripped before it runs. On Windows the PowerShell binary is resolved only from a fixed list of absolute install locations on C:, never from PATH.\n\n**Details**\n\n- The `sh` path runs with a fixed PATH and `LC_ALL=C` after deleting `ENV`, `BASH_ENV`, `LD_*`, `DYLD_*` and similar variables.\n- The `pwsh` path rebuilds `PSModulePath`, `PATH`, `PATHEXT` and `COMSPEC`, and drops `DOTNET_`, `COMPLUS_` and `COR_` variables.\n- If no stock PowerShell install is found, the helper fails rather than falling back to a PATH lookup.\n\n**Evidence**\n\n`PowerShell not found at any of its stock install locations on C: (fixed absolute candidates only; PATH is never consulted)`\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}